How to write a sub-processor list (template, and what customers check)

Of all the documents a customer asks a supplier for, the sub-processor list is the one they read most carefully, because it is the one they can check. Every entry names a company they can look up, a country they have a view on, and a claim about a contract they can ask you to produce. It is also the document most small suppliers get wrong, usually by naming tools instead of companies.

This is how to write one that survives a reviewer, with a template you can copy and twelve entries you probably need.

What a sub-processor is, and what it is not

If you process personal data on a customer's behalf (you are their processor), then any third party you use that also touches that data is a sub-processor. Your hosting provider, your email service, your CRM, your payment processor, your AI API. Under Article 28(2) GDPR you need the customer's prior authorisation for them, general or specific, and under 28(4) you are liable to the customer for what they do.

Not sub-processors: tools that handle only your own data (your accountant, your payroll provider, for the customer's purposes), and independent controllers you disclose data to on their own account. The line is whether the third party processes the customer's personal data on your instructions. Analytics on your marketing site is your business as a controller; analytics inside the product you run for the customer is a sub-processor.

The columns

• Legal entity. The company, not the product. “Mailchimp” is a product of Intuit Inc. “Google Analytics” is provided by Google Ireland Ltd in the EU and Google LLC in the US. Reviewers look the entity up; a product name looks like you have not.
• Purpose. What the sub-processor does with the data, in five words. “Transactional email”, “database hosting”, “payment processing”.
• Data categories. Optional but persuasive: contact details, payment data, usage data, content. It shows you know what flows where.
• Hosting location. The region you have actually configured, not the vendor's list of options. If you chose Frankfurt, say Frankfurt.
• Transfer mechanism. Where data leaves the UK or EEA: adequacy, UK IDTA, EU SCCs, or the EU-US Data Privacy Framework (with UK Extension for UK data) where the vendor is certified.
• Agreement. Whether a data processing agreement is in place and how: incorporated in the vendor's terms, signed separately, or not yet. “Not yet” is allowed on your own list; it is not allowed on the one you send a customer.
• Date added. So the customer can see what changed since the last version.

Twelve entries most small suppliers need

Entities and transfer mechanisms as recorded in Rowpa's vendor library on 4 September 2026; regions are the ones commonly configured. Check your own account settings and each vendor's current DPA before you publish.

Publishing it, and notifying changes

Most customer DPAs grant general authorisation on condition that you keep a current list somewhere they can see it and tell them before you add a sub-processor, with a window (often 30 days) to object. So the list needs a home with a date on it, and a way to notify. The usual shape is a public page with the current list, a version history, and an email to customers who have asked to be told. Big vendors run this at scale (Microsoft, OpenAI and AWS all publish theirs); for a small supplier the same three things fit on one page.

The three mistakes reviewers catch

• Products instead of entities. Covered above. It is the first thing a reviewer notices and it colours how they read the rest.
• Claiming a DPA you have not accepted. Many vendors incorporate their DPA into their terms of service, which counts, but some require you to countersign or opt in to a region. “DPA in place” is a claim the customer can ask you to evidence.
• A list that stops at the obvious. Hosting and email are on every list. The support desk that sees customer names, the analytics tool inside the product, the AI feature you switched on last quarter, and the contractor's laptop are the ones that get missed and the ones a breach comes from.

A template

Or keep it somewhere that maintains it. Rowpa's vendor register holds 400 source-linked entries with the legal entity, DPA link, hosting country and transfer mechanism, re-checked monthly. Your sub-processor list is the vendors you have linked to processing activities, published on your Trust Center at its own address, with a form for customers who want an email when it changes, and included in every supplier pack, with the DPA status shown honestly for each. How the published list works. What else goes in the pack.